MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 751979a730418403c73ea0e14c8ad5d77d4fd95de07a9cc24aa3ca21650ee1e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 751979a730418403c73ea0e14c8ad5d77d4fd95de07a9cc24aa3ca21650ee1e6 |
|---|---|
| SHA3-384 hash: | d9249a0f12bf9973facc54b47cbbfd720233e56559e641ba0d7a3ff82c5d1b51493153294cbe8a179387fe75139e00ae |
| SHA1 hash: | 8f42442250a3984087f073be34ca57fc9d98f377 |
| MD5 hash: | 6ff45ff7e9f7bfc45ae4a250850e4a6c |
| humanhash: | fillet-london-king-jupiter |
| File name: | P0_T6E52FH3.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 882'176 bytes |
| First seen: | 2023-06-21 10:39:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:l2qlPsUPM7q6bpw4dcZda/igbVzHS+93NPj/zMebR8T2iSsN3k5ZdleyTiv7obX:Mfzu4CZdObVzSa1bzMeSTnIfleXc |
| Threatray | 1'427 similar samples on MalwareBazaar |
| TLSH | T17315F10123780F5BD17E8BFD1420237093FDAA5A702BD74ACEC6B4DE6E61BD10A59A47 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 30b2c4c8c8c4b030 (53 x Formbook, 41 x RemcosRAT, 20 x AgentTesla) |
| Reporter |  pmmkowalczyk1111 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
299
Origin country :
PLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
P0_T6E52FH3.exe
Verdict:
No threats detected
Analysis date:
2023-06-21 10:40:20 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
comodo packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Leonem
Status:
Malicious
First seen:
2023-06-20 16:07:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
36
AV detection:
22 of 35 (62.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'417 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
c9166586444e241052fc96bfb741ec241feae0f5b5e304c8d53fc2a6b6f2054b
MD5 hash:
358a72c89b7ccf51c9d573d02a77fc17
SHA1 hash:
78722ee2d5090f9cd96bab461339733324cd531c
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
d7d0dadd6925bf07b8919fb26fb6082f035f3ceb13c60ca8e464b01c9e2c81a0
MD5 hash:
137f3e4c9e957be48bbccca2cc62be34
SHA1 hash:
46e4cd3e40bb7ef062f588e983f6e9eccd161e1b
SH256 hash:
bf30f7032a6e2fdd6a872718de569645dda2c9e734a4f90a77e5af9a58d75812
MD5 hash:
29432c0db5445ce74b8a1042234187af
SHA1 hash:
fdc1bce5c868fbaed48ff27b3cc73b752bc66e75
SH256 hash:
ae28a826aadf2b9f5beab0392baf5f28d2fe78772ee829dd7176eda538b02553
MD5 hash:
b536331634cad2b836cf2d7b5fe05889
SHA1 hash:
b27ed85810ff000a2435b8be653eb089281b8c1d
SH256 hash:
e24a5e1c644af31df00ae73f73e8425af3fc788ff226fb4134f3cd39a152a95c
MD5 hash:
a91562fb0bf7d2d116ad5bcb8a7a412c
SHA1 hash:
a24116f0d77157c129cac961bc7f8b62ad0d21de
SH256 hash:
a41ea9b985dfd6a004f3f6baf98ee71bd375def080c37962acf04a5af431a096
MD5 hash:
0ceef3efbf6d6581e7f20129df1b2ea5
SHA1 hash:
01091c42a568405a2e090c810446f6ca51ebf4ce
SH256 hash:
751979a730418403c73ea0e14c8ad5d77d4fd95de07a9cc24aa3ca21650ee1e6
MD5 hash:
6ff45ff7e9f7bfc45ae4a250850e4a6c
SHA1 hash:
8f42442250a3984087f073be34ca57fc9d98f377
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.